From c1331a592acafd8cbcca1f7822134180a9da8024 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Fri, 15 May 2026 05:48:14 -0700 Subject: [PATCH] waf-block page: escape literal % as %% (HAProxy lf-file expansion) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit End-to-end test of the 403 page showed CSS `100%` rendering as `100` and gradient stops `0%, 100%` rendering as `0, 100` — HAProxy's `lf-file` directive runs log-format expansion over the file content, and `%` is the format-escape character. Single `%` is consumed by the expander. Doubled every literal CSS percentage (`100%%`, `0%%`, etc.) so HAProxy emits a single `%` in the rendered body. Format expressions like `%[unique-id]` and `%[req.hdr(host)]` stay single-`%` — those are the substitutions we want. Added a comment block at the top of the file documenting the gotcha for future editors. Co-Authored-By: Claude Opus 4.7 (1M context) --- errors/403-waf.html | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/errors/403-waf.html b/errors/403-waf.html index 6bcace1..b35bbb4 100644 --- a/errors/403-waf.html +++ b/errors/403-waf.html @@ -1,4 +1,12 @@ + @@ -7,11 +15,11 @@ Request blocked · %[req.hdr(host)]